Attribute Capability Status

Scope

This reference separates repository implementation, immutable packaging, runtime inspection, product acceptance, and environment activation for the Attribute capability. It records the accepted AKS reference image without turning a successful request or runtime probe into a product status.

Definitions

Status	Meaning
SPECIFIED	Contract/design exists; runtime is not implied.
IMPLEMENTED	Repository code and tests exist; packaging or deployment is not implied.
PACKAGED	Artifacts are published or included in an immutable image.
DEPLOYED	An environment owner observed the exact artifact in an environment.
VERIFIED	The capability's complete acceptance contract has passed.
ACTIVE	The exact verified capability is enabled in its target environment.
BLOCKED	One or more required gates are incomplete or incompatible.
DISABLED	The system deliberately disables the capability.

Record ASSEMBLED as image evidence detail, not as a replacement for these lifecycle states. An assembled image can remain BLOCKED.

KEOPS #684 uses a separate runtimeState vocabulary. Its DEPLOYED value means that required components are available in the running realm. Product evidence uses productStatus; its DEPLOYED value requires an authorized environment owner to observe the exact artifact or image named by the record. Therefore runtimeState=DEPLOYED never implies productStatus=DEPLOYED, VERIFIED, or ACTIVE.

Allowed Values / Behavior

Capability ID	Current status	Evidence-backed statement	Open boundary
ATTR-DEFINITION-ADMIN	IMPLEMENTED	Definition CRUD includes versioned PATCH and DELETE with ETag/If-Match; #871 owner filtering, #868 value/applicability concurrency, and terminal KEOPS #1004 definition-delete concurrency are delivered. Attribute v2026.9.11002 is the expected-version contract origin; current provider release v2026.9.12001 also adds bounded type-only definition filtering. KEOPS consumer release v2026.9.12001 passed registry read-back for the delete contract.	Attribute #180 has only AC01 open, but its candidate service budget is explicitly deferred rather than approved in the current phase. KEOPS #1033 must consume the new type-only provider contract through the release coordinator; #1030 separately tracks update-definition not-found consistency.
ATTR-DIRECT-VALUES	IMPLEMENTED	Raw direct values, idempotent POST upsert, provider-side filtering/paging, and authoritative totals are delivered.	Direct values must not be presented as effective values.
ATTR-DEFAULTS-POLICIES	IMPLEMENTED	The bounded canonical read composes definition defaults and applicability/inheritance inputs. Attribute A1/A2/A3 are immutable through v2026.9.19002; realm-admin split-policy commands are immutable in KEOPS v2026.9.23005.	Admin #4953 / !1064 is Ready and mergeable at its corrected exact head; exact-head CI, AI, Sonar and 43/43 authenticated E2E passed with zero open discussions. EC07 exact-head CODEOWNER approval, merge and release remain open. Inputs must not be presented as an effective winner.
ATTR-EFFECTIVE-VALUES	IMPLEMENTED	KEOPS K2 v2026.9.21001 resolves generic effective attributes from a server-verified context, and K3 v2026.9.21002 exposes paged effective inspection with provenance/conflict and authoritative totals. Admin #5214 / !1052 is merged source integration. Separate Admin !1069 browser acceptance passes membership switching and a page beyond the first backend window at its exact head.	The Admin source is not a release. Admin !1069 is Ready but still CODEOWNER-gated; #5214 is not complete until that acceptance MR is merged. Reopened #4953 / !1064 also remains CODEOWNER-gated and unreleased.
ATTR-TOKEN-PROJECTION	BLOCKED (ASSEMBLED)	Direct selected-OU projection remains released by #1043, while K1 v2026.9.20003 and K2 v2026.9.21001 add server-authoritative context plus generic effective token projection across configured linear owner tiers. K4 policy authoring is immutable in v2026.9.23005. Image v2026.9.24 is released at immutable digest sha256:9da0c5ca77b77140dc71b6b38aa9cb342f2cd56e2451792be0d37b165676c004; tokenVisible=true remains eligibility, not automatic release.	Deploy-free Image #217 qualification MR !263 passed its exact-head pipeline against the same immutable digest: exact-image native projection 29/29, five smoke checks and all six lifecycle phases passed. The MR is Ready and reviewer-gated while #217 remains open at 11/12; GitOps reconciliation, Admin owner review/merge, documentation publication, umbrella closure and the authorized same-digest observation required only for ACTIVE remain open. API, browser, catalog, release, or #684 runtime success cannot manufacture VERIFIED or ACTIVE.

Current Delivery Checkpoint — 2026-10-31

The machine-readable currentDeliveryProgress record is the latest delivery checkpoint. It preserves aggregateStatus=BLOCKED, finalImmutableTuple=null, and deploymentObservation=NOT_OBSERVED while recording progress after the historical Phase 2 snapshot:

• Security #296 remains the contract origin; corrective #408 / MR !207 is immutable as v2026.10.29001. That release is a prerequisite, not the accepted final tuple.
• KEOPS #826 / MR !1259 is terminal. Merge c9ccb244cef812c390bca2e1ba2c14f13d078acc, post-merge pipeline 3007438701, and release pipeline 3007452986 are successful; immutable v2026.10.30 publishes io.smartface.keops:keycloak-ext-keops:2026.10.30. This is repository release evidence, not deployment or activation evidence.
• KEOPS #2309/#2310 is immutable in v2026.10.31002. Image catalog MR !398 and generated manifest MR !399 are merged; supported Nightly pipeline 3012891634 and release pipeline 3012906124 published Image/Helm v2026.10.31 at multi-arch digest sha256:db3aa2e897e2c95e9a30f56156fbf32a1d9a0ca10480e658b75184feff8da020. Both platform SBOMs contain 711 components. Trivy ran under block_on=never and its raw inventory is CRITICAL 6 / HIGH 7 / MEDIUM 20 / LOW 1, so this release is not described as finding-free. Deployment and activation remain unobserved.
• Product #667's Java credential-provider slice is immutable as Java SDK v2026.10.29 through MR !148, but Product #667 remains open for JavaScript parity and compatible-set evidence.
• JavaScript SDK MR !93 is terminal in v2026.10.29; follow-up MR !126 is terminal in v2026.10.29001. These immutable npm releases are predecessor evidence, not a live Product #667 compatible-set or K15 acceptance receipt.
• KEOPS #826 unblocks Admin Console #4769/#4770/#4771 source qualification. Draft MR !1418 is at exact source 768f54daa4e00179b55ff1f51fe9a13008154ff0; pipeline 3008952380 passed with warnings because its allowed-failure E2E job failed. The Draft remains CODEOWNER-gated and unreleased.

Access !189 is terminal in v2026.10.31002; Access !190 at exact head 9618e16530fa4a54eb071c1908045097d1b7a4f0 has a successful exact-head pipeline but remains Draft without merge or release inference. These facts do not replace the preserved historical evidence below. The remaining compatible-set chain is KEOPS #1333 / !1261 post-Image digest-equality qualification -> Gateway #713 / !188 at be067a74c3b9409fbede8eaec4cd1920a02d9219 -> Product #668 K15 positive/negative E2E -> SDK JS !129 immutable-set requalification. Admin release, GitOps/environment observation, GİB Test/UAT, activation, and authorized acceptance remain separate later gates.

Historical Phase 2 Progress — 2026-09-24

The additive phase2CurrentProgress record supersedes stale live-state wording without rewriting the historical receipts below:

• Attribute A1/A2 is released as v2026.9.19001 from !194 source affa92948ec5162db6e095c790b75047afba26cb; A3 is released as v2026.9.19002 from !195 source 6cf1355a4e150aa8faa1b83cf888976b0ec64a79.
• KEOPS K1/K2/K3 are immutable as v2026.9.20003, v2026.9.21001, and v2026.9.21002. K2's artifact exists and was read back, but its aggregate release pipeline failed in a post-publication helper; this documentation does not rewrite that pipeline as passed.
• KEOPS #1134 / !724 is terminal through immutable v2026.9.23002, source 9164f76e61909cd7796c9788f150f73af8ecd316 and release commit 3fa105650898daa4172ab05390b51ba634ba773f. K4 #1062 / !714 is also terminal: exact source c31365bba9f5782f40ddf4be4ef5f4791bc9bcde passed 7,377 tests, current GitNexus and Sonar Quality Gate (90.4% new coverage, 0.0% duplication, zero findings). It merged as 6f6273db15dd68ec575de62c3f511176df68ede4; release pipeline 2876679408 published immutable v2026.9.23005 / Maven 2026.9.23005. All 12 package records and authenticated root POM/core JAR read-back are verified. This is repository delivery, not final-image inclusion or activation.
• Generated Image !258 adopted KEOPS 2026.9.23005 into the AKS provider catalog from exact source 052f436393db6bb29b75ab663c141b7dafcd4e2a and merged as 554c1285107f2d915baa9ae4c3fc8e40156b5abb. Its exact pipeline and 408 repository tests passed; merge-SHA pipeline 2876792803 passed every required job and remains MANUAL only because the separate release-branch jobs were not triggered. This is catalog adoption only: no image build, digest, release, deployment, GİB profile change, VERIFIED, or ACTIVE state follows from it.
• Image #395 and supporting #577 are Closed / Done. Image source 45ad13031f93479db54475f9b347cba51e2a49da merged as b1d4f82b9a70e653a671bd7f5de417c487d7c68f; release pipeline 2878285124 published v2026.9.24 at immutable multi-architecture digest sha256:9da0c5ca77b77140dc71b6b38aa9cb342f2cd56e2451792be0d37b165676c004. The manual deployment job was not triggered and no environment observation exists. The earlier deploy-free attempt failed closed on a stale runtime-authority cohort and an incoherent predecessor fixture. Image #217 qualification MR !263 corrects those acceptance inputs without changing the image: exact source 4fd2467e24cf1c41b93aa7fdbf13213555126dff passed pipeline 2879454266, all five required jobs, 29/29 exact-image native projection tests, five startup/provider/default-deny checks and all six lifecycle phases against coherent predecessor v2026.9.23001. The accepted candidate bytes remain the same immutable v2026.9.24 digest. This is deploy-free qualification evidence on a Ready MR, not deployment, ACTIVE, #217 closure or an accepted final tuple.
• KEOPS #1169 / !758 is terminal in immutable v2026.9.23004, source df0c7d218056fabde3086c582a89a771179e089a and release commit 7171428ea0ffa470a740339cf1d5f842451b764b. This adds conditional projection-read validators; it does not supply final image inclusion or activation evidence.
• Admin #4279 implementation MR !966 is merged at source 5a6956531ab131588a24b4ea39f28956d01843e9 / merge 96322c8c3cc92f4b62855c17170746fcbd6004c0; pipeline 2850982459 passed. The work item remains open and requires lifecycle/checklist reconciliation; its old "MR pending" wording is no longer current. Admin #5214 / !1052 is merged from exact source e958254fe892dce0705c062bae84171e485ef717 as e7a51163bfec4e784a21f3cf15f5cb741bba9086; exact pipeline 2875065102 passed. It remains unreleased. Admin #4953 is reopened and !1064 is Ready at corrected exact source b838542d1f61e84910ed49ed3c45536e4e2ca7d7 / tree 412c2ccf339b967647c6a9f6a4065e7320147d6b. Exact-head pipeline 2879428625 passed required validation (950 files / 9,481 tests), production build, TypeScript, Sonar Quality Gate (86.4% scoped coverage), zero-finding AI review and 43/43 authenticated Chromium E2E in job 16714129415, including the Defaults and Policies scenario. GitNexus is exact/current at 49,795 nodes and 121,445 edges. The earlier contract-bound and localization findings are addressed, all discussions are resolved, and the MR is mergeable. EC01-06 are checked; EC07 exact-head human approval remains open and CODEOWNER review was re-requested from Eren Kan, Muhammed Oguz and Burak Yıldırım. The MR is not approved, merged or released.
• Separate Admin #4279/#5214 browser-acceptance MR !1069 is Ready and mergeable at exact source 4e0e8c249293b27d729f004ac3bddd03d3ef8fb3 / tree a180c04009927001fb5ba04e528fdd097e2e6ad8. Pipeline 2879482114 passed required validation (947 files / 9,426 tests), AI review and 42/42 authenticated E2E. The isolated Chromium acceptance harness also passed 2/2: exact membership replacement plus a page beyond the first backend window, and a release request containing the selected client UUID while omitting the unselected UUID. This proves only the Admin request boundary. #5214 is now 5/5 in In review; #4279 remains 7/8 in Acceptance. Human approval from the requested CODEOWNERS Eren Kan, Muhammed Oguz or Burak Yıldırım, merge, Admin release, immutable-image token presence/absence and ACTIVE remain open.
• GitOps #419 / !218 is Ready, mergeable, disabled and undeployed at exact source 448f3d4fddbaa2f1c7239b0e491311525e5287ab / tree ccd63929657cc55316be099b78f1419c4f4adb49. Exact-head validation passed 48 projection, 9 workload- isolation and 31 ASSOS reconciliation tests, all 327 YAML files, compile-all, Helm lint, diff-check and exact GitNexus coverage of all 491 files. Pipeline 2879395856 passed every required job; Sonar Quality Gate passed with 80.9% changed-source coverage and zero new findings, vulnerabilities or security hotspots, and AI review has no open finding. The six-phase released-image native apply/retry/rollback/restart/reapply/idempotency evidence remains bound to the prior semantic source b7983da1a2f551b05cbdce401086c314a39f4ee3, while exact-head tests prove the bounded refactor and template-redaction delta. Ali/DevOps review, merge and separately authorized environment enablement, deployed read-back and activation remain pending. Repository readiness neither enables reconciliation nor supplies a deployment observation.
• KEOPS #1071 / !662 is terminal and first contained in immutable v2026.9.20001. Promotion enforcement now defaults to ADVISORY: missing or invalid promotion evidence remains truthfully UNAVAILABLE, but does not add a promotion-evidence block to an independently authorized non-promotion mutation. ADVISORY never authorizes a mutation or weakens its permission, locality, audit, or capability checks. An operator must explicitly select ENFORCED for every non-ACTIVE result to add the promotion-evidence block to those mutations. ACTIVE remains fail-closed in both modes and requires the authenticated ACTIVE result, signed ACTIVE, a matching authorized observation, and runtime DEPLOYED; neither mode may translate API or pipeline success into VERIFIED or ACTIVE. Candidate-specific Product Security and T901 qualification is not a prerequisite for the approved initial ADVISORY closure; signed evidence qualification is deferred to the later explicit ENFORCED hardening gate.
• Admin #5166 / !1009 is terminal merged at source 00b015b9d5f0573782ea467e33520da58a297801 / merge acf43d608aa686de811d69dca907728bd68758f3; pipeline 2853683617 passed. It renders the advisory state as a warning rather than a false activation or unconditional block. This is source integration, not an Admin Console release or product activation receipt.
• Product Security #257 is Closed / Done at 9/9 and the T901 run in GitOps #426 is Closed / Done at 20/20. Their retained native is blocked by links point only to already-Done historical work; neither has a current blocker. T901 is retired for the current role-free contract. Security #309 is a non-blocking later Refine item owned by eren.kan at 0/6; local cleanup #428 is a non-blocking To do item owned by halil.ozkan.sf at 0/6, with runtime absent/status unknown rather than currently Stopped. Neither historical record proves the current candidate, final image, shared-environment activation or signed same-digest ACTIVE.

The aggregate remains BLOCKED and finalImmutableTuple remains null. Image #392 is open/native Blocked. The candidate release and digest are recorded with passed deploy-free #217 qualification on Ready MR !263, but they do not populate the accepted final tuple while #217, #287, #419, Admin and documentation gates remain open; no deployment observation exists. The Console must continue to consume #683 configuration and #684 runtime state separately, and must never derive product VERIFIED or ACTIVE from a successful API call.

Typed-source reconciliation — 2026-09-14

The product-owner decision identifies orgId and vdKodu as ORGANIZATION_UNIT-owned contextual facts, not inherited USER facts. Attribute Management #65 v1.3 now records the corrected owner and a 15-row acceptance oracle. All rows are checked and the request is in Acceptance; request-level confirmation, not implementation or publication, is the remaining issue gate.

KEOPS #1043 / MR !641 exact source 1f0383412758853c858df187b1b4c4abe282400f passed 1,520/1,520 application tests, 5/5 real Keycloak 26.7.2/PostgreSQL composite-release tests, the selected-context token/refresh/hat-switch scenario, and exact pipeline 2848344975, then merged as 08a18f549da953a2724ec2ea1087cea100544b5d. Successful release pipeline 2848372441 published immutable v2026.9.14005 / Maven 2026.9.14005 from ca66035418d8dbb10eaa2acf025dbd2e7924778d. Authenticated target-version-clean read-back resolved 12/12 primary coordinates as regular files with zero symlinks. The evidence receipt is Attribute #65 note 3832444096; representative SHA-256 values are provider JAR 65e237fbf3176a159009d35bb8608bb560ff444bb6e0fc1a53265894137dc153 and root POM ebda5389ce62195c4598445a8a9188a4686a63e6e164ed7b79f1bfad0502c42a. This closes the direct selected-OU typed-source gap without copying values into USER attributes. tokenVisible=true remains eligibility only; Security, client/scope/surface, collision, sensitivity and payload gates still apply. The broader capability row remains BLOCKED because the final immutable image/activation tuple and generic effective USER inheritance are separate open boundaries.

KEOPS #1007 / MR !624 is a separate, completed correction at source c01cdc093cacc8ccd6933d0d6397aa17494d998f, merge 151dd98e1384f670b589df890ebeb4c60d056348, and pipeline 2843893994. It makes an absent selected context a non-terminal contextual omission so unrelated USER claims can continue. It does not add ORGANIZATION_UNIT projection by itself; that support is delivered separately by #1043. Missing context is therefore benign and bounded; malformed, conflicting, revoked, or otherwise invalid explicit context remains a terminal fail-closed condition.

KEOPS #865 is complete for bounded provider-side value/fact queries and authoritative totals. KEOPS #866 is complete for the canonical Defaults and Policies input read. KEOPS #867 is complete for typed diagnostics and provenance. KEOPS #868 is complete for value/applicability optimistic concurrency, and KEOPS #1004 is terminal for definition-delete concurrency. KEOPS #871 is complete for authoritative definition owner filtering, and KEOPS #723 is terminal for stable definitionId transport. These completed implementation records do not close #80 and do not promote the effective-value capability beyond BLOCKED.

The historical reference baseline remains Attribute Management v2026.8.30003 at 1ec709a6b7ae069426ce44986de9c3af3f918633 and KEOPS v2026.9.1003 at 11131dae3055477f73faba63d331b30fc6d2af7d. The manifest also preserves the former Goal 5 backend candidate as historical immutable release evidence. Neither historical cohort is an accepted replacement image or the current final tuple.

The preserved attribute-capability candidate backend cohort is recorded as RELEASED in the machine-readable manifest: Attribute Management v2026.9.6, Membership v2026.9.3001, and KEOPS v2026.9.5 all have immutable registry evidence. This is a pending-integration cohort, not the accepted image. Migration integration, a new immutable image and exact acceptance must bind the whole tuple before the current capability matrix can consume it.

For every backend row, reviewedSourceSha identifies the reviewed implementation source and releaseCommitSha identifies the commit referenced by the immutable release tag. The release pipeline records its own source SHA and aggregate pipelineStatus; validationResult describes only the named validation job. Attribute v2026.9.6 and KEOPS v2026.9.5 have FAILED aggregate release pipelines with passed validation jobs. Their RELEASED state is supported separately by the existing release tag, registry package ID, and matching POM/JAR hashes; this documentation does not rewrite either aggregate pipeline as passed. Membership v2026.9.3001 has a passed aggregate release pipeline.

Every released cohort row has a globally unique, namespaced evidenceId. Capability evidenceRefs resolve those stable semantic identifiers rather than ambiguous child names such as attributeRuntime; a later immutable tuple substitution changes evidence bytes without changing the meaning of the reference.

Historical Frontier Clarifications — 2026-09-15

These clarifications supersede stale live-state wording in the dated preparation snapshot below; they do not rewrite its immutable historical receipts or promote any capability:

• Attribute #65 remains OPEN / In progress with 15/15 criteria checked. Its receipt-time Acceptance state is historical; checklist completion alone does not supply final request acceptance.
• Admin !966's observed target is 81e5f41cdf23dc7c36cc8ee240700a36c6e9eeb5, with 32 target-only and 16 source-only commits from the recorded merge base. Its description now distinguishes current exact-source CI from historical test counts. Eren Kan and Burak Yıldırım are the CODEOWNER decision owners; the remaining Eren thread requires signed same-digest ACTIVE observation, not full Image #392 parent closure. Only the finding owner resolves that thread.
• Image #434 / !220 and preventive hold #520 / !223 are merged source work, no longer an Ali approval wait. #434's named-check EC-10 evidence reconciliation remains separate from final same-digest runtime acceptance; neither merge produces ACTIVE evidence. Image #217 and #392 remain open.
• Required policy audit uses existing Event publication under the approved first-release decision; explicit result/delivery semantics are deferred Event #148, related rather than blocking. The local Attribute unconditional-denial correction is still unqualified. See required audit generation and delivery limits.

The machine-readable preparation snapshot below retains its dated evidence until a coherent producer/consumer/image tuple is qualified. Its BLOCKED aggregate and null final tuple remain truthful; a local documentation or audit-contract correction cannot replace the final tuple.

Historical Preparation Snapshot — 2026-09-13

currentPreparation is an additive work-in-progress snapshot, not a released cohort. Its aggregate status is BLOCKED and finalImmutableTuple is deliberately null:

• Attribute Management v2026.9.11002 from #249 / !170 is the released origin of the expected-version definition-delete producer contract (contractOrigin). The current released provider is recorded separately under currentCompatibleRelease: Attribute #254 / MR !175 exact source 41f9035f46e85884aa64c7d237a042046e7c64c3, merge ac6480f66e9a3a4758fd3478632f22dcb5568588, immutable v2026.9.12001 at 8e465cce2e5976578d228f8303a9f48e5b6d2983, package 69215751, POM SHA-256 475fe750119b06e77a3ab09b55c8568c5c4701ece68015ee4e0925d045e1a7d3, and JAR SHA-256 37d6f101b9f5c9a9855771a8a1114b973ac69902c38d2218220d93109018e1ad. Exact-head pipeline 2843372922 and release validation job 16464206663 passed. Release pipeline 2843382927 failed only in a post-publication mapping helper; publication is valid and the aggregate pipeline is not described as passed. Attribute #254 is consequently reopened, 4/5, and native In progress until an exact-source aggregate-success release receipt exists. KEOPS #1033 remains blocked because develop@151dd98e1384f670b589df890ebeb4c60d056348 still consumes 2026.9.11004; the release coordinator must advance it to 2026.9.12001 without a manual pin.
• Attribute #180 / completed Task #253 / merged MR !173 has passed 687 unit tests, 85 integration tests, coverage, and a PostgreSQL 17 local verifier for the bounded VALUE_AND_RECORD_KEYS scope at source aabd185c1277cbe146653f83af3962e089ff4a7c; source pipeline 2842563837 passed and merge commit 1e1c8fc017abcf52df3a19293456bf0c34cb3b9c records that slice. Follow-up MR !174 merged as 1d3bea5eee00a2131908ae72a8240bf4c2d174bf; immutable Attribute v2026.9.12 was published and adopted by Migration MR !254 exact 5840c56ab2f12db0711af60d1c9f90391e058e0c, merge 86535d755ae9e4c887db5a6fa05673499cf510fe, pipeline 2843317968. Product deferred AC01 in the current phase; it did not approve the candidate 6,000 ms request budget or 3,769 ms database-query ceiling. Parent #180 therefore remains open at 11/12 with native status Blocked, and both approved budget fields remain blank. Existing implementation/release/adoption evidence remains reusable unless its inputs change or product reopens AC01.
• Migration v2026.9.11001 is a released implementation. Migration #209 now visibly has all 41/41 description checkboxes selected, but its work item remains open with native status Blocked behind deferred Attribute #180 AC01. Migration #287 likewise remains open at 10/11 with native status Blocked; EC11 is not accepted. Checklist completion is not operational acceptance or work-item closure.
• KEOPS #1000 and KEOPS #1004 are terminal. MR !623 merged source 6f2667769a22fb94e957fbfa3c8f82fb037fe44a as 81130a65158e11ec66b81eeb1b49dc947b0fa4c2; source pipeline 2842592151 passed. Exact-head verification passed 4525 unit and 751 integration/native tests (three deliberate skips), focused native 6/6, coverage, Sonar with 0 changed issues and 0 changed hotspots, and AI review. Consumer release v2026.9.12001 at 6d9b14e4855bf4cf277f687c508114cd623d6ff6 passed release pipeline 2842629248, validation job 16460381227, and empty-cache registry read-back for 12 POMs and 11 JARs. Separate Task #1030 remains open for adjacent update-definition not-found mapping consistency; it does not reopen #1004.
• Technical Docs preparation MR !27 merged source 89d969d70055bd992578c75c7842ad3dffd0ebc7 as 77ef7811b5ce713a9d7e38ec628a225e42700cd5; pipeline 2842585562 passed. Technical Docs #121 remains open and In progress with 0/7 acceptance criteria, so the preparation merge is not publication completion.
• Admin Console MR !966 is open at a68494c8829c63c8c70c1062fed48c46dc568ce6; pipeline 2846108863 passed, but the MR remains in requested-changes state and waits for a same-digest, real-environment signed ACTIVE receipt. Full Image #392 closure is not its direct dependency. Its merge base 9ed2988253956271314b424f041a4ac598e657c5 differs from current target 2e42aea33f431661cec872df639a6715ee01d7a6; target and source contain 10 and 16 exclusive commits, respectively. The branch has diverged and must be rebased and revalidated only after that receipt exists.
• Admin #5079 / MR !991 delivered server-side subjectType filtering. Source 949d980eac66248985734fc54873c0ec0cd63098 passed pipeline 2846013775 and was merged as 86505ffb714a2e10ee2d6860a6ff4fa2d5418ca0. The retained evidence includes 7,057 tests across 768 files, 38/38 browser E2E, Sonar, AI, and independent review passed. The three prior blockers are corrected, discussions are resolved, and work item #5079 is closed. This merged source evidence is not an Admin Console release and does not clear Admin !966, Image #392, or aggregate capability state.
• Admin #5078 / MR !992 delivered version-fenced definition deletion. Source 9b80fcccad266840b3f0472497096e9d5ba8cedd passed pipeline 2846070573 and was merged as 9ed2988253956271314b424f041a4ac598e657c5. The retained evidence includes 7,041 tests across 772 files, 39/39 browser E2E, AI review, and the branch-diff Sonar check with zero new issues or hotspots passed. The native first-analysis Sonar result remains informational, not hidden. Work item #5078 is closed; an Admin Console release remains pending; non-blocking recovery-pending hardening remains in #5146.
• Admin #5082 / MR !994 keeps token projection eligibility conjunctive and fail-closed, including cached-definition/refetch errors. Source bf0cff1d1ac04caf6d7a581a1a80dfe9f2cf0232 passed pipeline 2844300684 and was merged as b7990839970b095c541eb7ba6c82952c717f6130. The retained evidence includes 7,036 tests across 769 files, Sonar, AI, and independent review passed. Browser evidence has 40 terminal passes, zero failures, and one disclosed navigation retry. Work item #5082 is terminal; this is not release, deployment, VERIFIED, or ACTIVE evidence.
• Image !218 was approved and merged catalog-only source 61ee8b5ff13f28e599213b2a857c80c1bb2518b3 after source pipeline 2842632742 passed, as 8cfe97549f7f334cf588de8c34321e1ba2c37f4a; generated #512 closed and the source branch was removed. Post-merge develop pipeline 2842775693 passed all automatic mandatory jobs, including 331 provider tests, policy, Sonar, and security, then remained aggregate MANUAL only because the deliberate release jobs were not triggered. This is provider-catalog evidence only: no image was built, released, deployed, or promoted, and the GİB manifest was untouched.
• Image #395 AC-09 is explicitly profile-scoped by correction note 3824621450: AKS evidence may satisfy only the AKS row, while GİB remains UNVERIFIED/BLOCKED until its independently owned #443 evidence exists. Evidence is never reused across profiles and no target tuple is approved by that correction.
• Image #392 remains BLOCKED by #287, #217, and #419. Closed #395 is evidence under active final-acceptance blocker #217, never an active blocker itself. No accepted final release/digest, deployment observation, VERIFIED, or ACTIVE state is inferred.

The manifest's releaseFlowPolicy records the current delivery decision: preserve the existing release flow and defer the Pipeline/Image automation transition tracked by Pipeline #185, Pipeline #187, KEOPS #914, and Image #477. This scheduling decision does not provide technical acceptance, close those work items, bind the released backend tuple into an accepted image, or change any capability to VERIFIED or ACTIVE.

Promotion ownership and state boundary

Promotion is a separate, fail-closed chain; the accepted image record is not its authority:

• GitOps #429 owns the externally signed keops.attribute-projection-promotion/v1 attestation with VERIFIED and ACTIVE phases. A signed VERIFIED attestation is valid without a deployment observation. A signed ACTIVE attestation additionally requires an authorized observation of the matching image digest.
• KEOPS #894 owns the authenticated, fail-closed admin read model. It exposes UNAVAILABLE, VERIFIED, or ACTIVE; signed VERIFIED remains VERIFIED even when the independent #684 runtime read reports DEPLOYED. ACTIVE requires signed ACTIVE, its matching authorized deployment observation, and live #684 runtimeState=DEPLOYED.
• Console #4279 consumes the KEOPS read model. Only its exact ACTIVE result may enable the governed controls.

Image #392 remains the immutable ASSEMBLED evidence and operations-handoff owner. Image #392 does not sign or promote VERIFIED or ACTIVE, and Console does not reconstruct those states from Image, GitOps, or runtime evidence.

The current Image #392 closure DAG has three exact blockers:

• Migration #287 must supply migration operational acceptance.
• Image #217 owns final exact-image acceptance. Closed Image #395 and #577 provide candidate evidence, and Ready MR !263 now passes the same-digest deploy-free matrix. #217 remains an open closure node at 11/12 until its qualification and final capability status are reconciled.
• GitOps #419 must supply existing-realm reconciliation evidence.

Security #257 historical manager-only acceptance remains evidence for the recorded digest only. It does not replace the completed candidate target-authority evidence or the final exact-image acceptance owned by Image #217, and it cannot clear any of these three current blockers.

It also does not describe the current authorization mechanism. Security Management !115 and !116, released together in v2026.9.10, retired both attribute-projection:manage and attribute-projection:approve-confidential. KEOPS #955 and !611 consumed that no-dedicated-projection-role contract. The temporary current boundary is manage-realm, realm-local administration, mandatory audit reason, and distinct maker/checker identities. A replacement scoped gate is deferred under non-blocking Security #309.

GitOps #429's producer is delivered in merged !217. The pending signed-attestation gate describes actual candidate evidence, not the producer's implementation status. See the delivery and attestation distinction.

KEOPS #894's consumer is delivered in merged !566 and immutable v2026.9.5. Its current UNAVAILABLE result describes missing candidate-qualified signed evidence, not unfinished consumer code.

These future signed phases and API states do not rewrite the historical aggregate snapshot below. Its current productStatus remains BLOCKED, its promotion-owner gates remain PENDING, and its deployment observation remains NOT_OBSERVED until an authorized replacement record supplies the required evidence.

Used By

• Attribute Definition Model
• Attribute Values and Resolution
• Admin Console Attribute Workflows

Minimal Example

{
  "capabilityId": "ATTR-TOKEN-PROJECTION",
  "productStatus": "BLOCKED",
  "assemblyState": "ASSEMBLED",
  "runtimeAcceptance": "PASSED",
  "productSecurity": "HISTORICAL_MANAGER_ONLY_PHASE_APPROVED",
  "t901": "PASSED_ISOLATED_LOCAL",
  "migrationOperationalAcceptance": "PENDING",
  "targetAuthorityMatrix": "PENDING",
  "existingRealmReconciliation": "PENDING",
  "signedPromotionAttestation": "PENDING",
  "authenticatedPromotionReadModel": "UNAVAILABLE",
  "deploymentObservation": "NOT_OBSERVED"
}

Invalid Example

{
  "capabilityId": "ATTR-TOKEN-PROJECTION",
  "runtimeState": "DEPLOYED",
  "productStatus": "ACTIVE",
  "deploymentObservation": "NOT_OBSERVED"
}

The invalid example promotes state without the signed ACTIVE attestation, matching authorized same-digest deployment observation, live runtime requirement, and open product gates.

Immutable token-projection evidence

The exact AKS reference image is v2026.9.1001, source cd264a538f860da3d8eb0fdbb9e7e280bc9d1fc9, tree 2ae4acbc46b14018bd248bc0adb3cbce5fabade9, and digest sha256:fefde3b5ca01d0aaf0aedb1f85418cc3f2fab4b847e2dc6f62be2bd01205f93a.

• Assembly: pipeline 2810508684, manifest job 16239526920.
• Exact-image acceptance and lifecycle: pipeline 2810542712, jobs 16239794237 and 16239794238.
• Deploy-free operations handoff: pipeline 2810595081, job 16240208485.
• Product Security: Security #257, 9/9 scenarios passed for APPROVED_CURRENT_MANAGER_ONLY_PHASE; final evidence is note 3757319274. This is historical manager-only evidence for the recorded digest, not candidate-specific target authority. CONFIDENTIAL projection remains disabled and deferred to Security #290.
• T901: the realm-local technical matrix passed in an isolated local profile under GitOps #426, with bounded evidence in note 3757146654. It is not a shared-environment or same-image-digest deployment observation.
• Current authorization: Security !115/!116 and KEOPS #955/!611 retired both dedicated projection roles. GitOps #426's completed role-provisioning matrix is historical evidence only; its retained stopped local profile is tracked for non-blocking program-end cleanup under GitOps #428.
• Final evidence record: Image MR !176, reviewed head f6fa4328cfd2e7bede757e54da4b478277f7e767, merge commit ee06bfc88ccd29c31a5dd93e4b04d939b90e71d9, pipeline 2810709836.

The T901 #426 run used release 2026.8.29002, not candidate v2026.9.1001. Both identities are manifest-list digests; this is not a config-digest versus index-digest alias. The retained lifecycle job 16239794238 records them as distinct predecessor and candidate images (immutableDistinctImages=true). T901 #426 remains complete for its tested scope, but does not qualify the candidate for signed promotion. Security #257's historical manager-only acceptance likewise does not explicitly bind this candidate digest. GitOps #429 requires new candidate-qualified Security and T901 acceptance evidence before producing a real VERIFIED record. Synthetic publisher tests cannot replace it.

The acceptance run used the immutable image without rebuilding it, passed the governed 29-scenario five-surface matrix with zero failures/skips, preserved identical provider snapshots with zero injection, and passed the six-phase lifecycle test. It intentionally performed no release, deployment, promotion, Helm, ArgoCD or GitOps mutation.

Therefore this evidence proves ASSEMBLED runtime acceptance, not DEPLOYED, VERIFIED, or ACTIVE. The machine-readable source is evidence/attribute-capabilities.json.

Runtime Inspection Versus Product Evidence

Two released KEOPS reads help consumers inspect the running realm without promoting product state:

• KEOPS #683, released as v2026.8.23002 from 0126e4b35791a94538a87c1f80a6d14b641906b9, reads the bundles, rules, and native client assignments that currently reference one definition. It reports observable configuration, not ACTIVE or VERIFIED capability state.
• KEOPS #684, released as v2026.8.23001 from 041080302d474638d66b3eb99b1ca151a07622c0, reports runtimeState component availability as DEPLOYED, BLOCKED, or DISABLED. It cannot emit a productStatus, and its DEPLOYED result does not prove product deployment, VERIFIED, or ACTIVE; those states require the immutable evidence and product gates on this page.

A successful administration request is not a substitute for either read. GİB Nexus/profile acceptance remains a separately owned deferred release lane and does not block the accepted AKS evidence recorded here. A mutable next-build catalog that differs from the accepted tuple requires a new image and acceptance run; it does not retroactively invalidate this frozen reference image.

Notes

Repository release identity proves which source was published. Image acceptance proves the exact assembled cohort. VERIFIED does not require a deployment observation. Environment activation does: ACTIVE additionally requires signed promotion authority, an authorized observation of the matching image digest, and the live runtime result. Do not substitute one evidence layer for another.

For day-2 evaluation and the product-to-technical migration handoff, follow Attribute Capability Verification. For mismatched evidence, use Attribute Capability Status Troubleshooting.

Next Steps

Use Attribute Capability Verification to collect and compare the immutable source, image, deployment, and runtime evidence required by the next product-state decision.

Related Docs

Attribute Definition Model

Review definition identity and governance boundaries.

Attribute Values and Resolution

Distinguish direct, default, and effective values.

Identity Attributes and Claims

Follow the token projection decision chain.

Attribute Capability Verification

Apply the runtime and product state boundary operationally.

Capability Troubleshooting

Diagnose mixed or incomplete capability evidence.

Related Work

• KEOPS #80 — effective resolution
• KEOPS #871 — definition owner filtering
• KEOPS #723 — stable fact definition ID
• KEOPS #865 — value/fact query pushdown
• KEOPS #866 — Defaults and Policies read
• KEOPS #867 — effective diagnostics
• KEOPS #868 — remaining optimistic concurrency